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MODULE FOR CONTROLLING A DRIVE AND METHOD OF USING THE MODULE 



5 Cross-Reference to Related Application : 

This application is a continuation of copending International 
Application No. PCT/DE00/02201, filed July 5, 2000, which 
designated the United States. 

lP Background of the Invention : 
;f! Field of the Invention : 

i-TJ The invention relates to a module for controlling a drive, a 

m 

s control device for an installation, and a method for 

§=* controlling a drive using such a module. 

□ 

o 

W The present invention relates to a module for controlling a 
drive, in particular a drive in an installation that can 
endanger public safety. The drive has two terminals for 
connecting to a control system for operating tasks and a 
20 control system for safety tasks and also has one or more 
outputs . 

Installations that can endanger public safety are understood 
to be, inter alia, power stations, in particular nuclear power 
25 stations. Electrical drives present in these installations 

are driven both by a control system for operating tasks and by 



-1- 



TER99P3467 

a control system for safety tasks. It must be ensured that 
the commands of the control system for safety tasks have 
priority over the commands of the control system for operating 
tasks. A module is used for this purpose, which module is 
5 also referred to as a priority module. 

A module of this type is used by the applicant, for example. 
The known module is relatively large and has a high power loss 
C of almost of 5 watts. In the case of retrofits in 

l£ installations, the existing space is therefore often the 

m 

limiting factor. Furthermore, the known module is driven via 
W individual wires and can therefore be integrated into digital 
~j control systems only with difficulty. 

15. Summary of the Invention : 

It is accordingly an object of the invention to provide a 
module for controlling a drive and a method of using the 
module which overcome the above-mentioned disadvantages of the 
prior art devices and methods of this general type, which has 

20 smaller dimensions and a lower power loss than the known 
module and can also be integrated into digital control 
systems . 

With the foregoing and other objects in view there is 
25 provided, in accordance with the invention, a module for 
controlling a drive. The module contains a terminal for 
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connecting to a control system for operating tasks and a 
control system for safety tasks. Commands from the control 
system for safety tasks have priority over commands from the 
control system for operating tasks. A microprocessor is 
provided for processing the commands from both the control 
system for operating tasks and the control system for safety 
tasks, the microprocessor is coupled to the terminal. A logic 
circuit is provided for prioritizing the commands from the 
control system for safety tasks, the logic circuit is 
connected to the microprocessor. At least one output is 
coupled to the microprocessor and/or the logic circuit. An 
interface is provided for connecting to one of the control 
system for operating tasks and a diagnostic device, the 
interface is connected to the microprocessor. A memory is 
provided for storing the commands and replies, the memory is 
connected to the microprocessor. 

In the case of the module of the type mentioned in the 
introduction, the object is achieved according to the 
invention by virtue of the fact that the module contains a 
microprocessor for processing commands, a logic circuit for 
the priority of the commands from the control system for 
safety tasks, an interface for connection to the control 
system for operating tasks or a diagnostic device, and also a 
memory for storing commands and replies. 
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The measures according to the invention enable the dimensions 
and also the power loss to be halved. It is possible, 
therefore, to accommodate twice as many modules as before on 
the same space. In this case, the evolution of heat remains 
unchanged owing to the halved power loss, so that existing 
auxiliary systems, such as a ventilation system, for example, 
can be adopted even in the case of retrofits. Furthermore, 
all the commands and the associated replies can be stored in 
the memory and be read out and monitored for test purposes. 
The logic circuit ensures the desired priority of the commands 
of the control system for safety tasks. On account of the 
interface, the module according to the invention can be 
integrated quickly and simply into digital control systems 
and/ or be connected to a diagnostic device. 

The microprocessor advantageously contains a timing circuit. 
The commands and replies can then be logged together with the 
time of day. 

In an advantageous refinement, the logic circuit is provided 
with a fixed-programmed priority function for commands from 
the control system for safety tasks . The priority of the 
commands from the control system for safety tasks is therefore 
left unaffected by changes in the software, thereby precluding 
inadvertent erasure of the priority. 
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In accordance with an advantageous development, the module has 
at least one electronic protection device protecting against a 
short circuit of an output. This protects the module from 
damage and increases the service life. 

5 

The module advantageously has coding plugs on a side which is 
accessible in the installed state. By the coding plugs, the 
assigned drive can be moved into a position such as open or 

H- closed, or on or off, and be kept there. This intervention 
rt£ has topmost priority and is independent of the control 

°j~ systems. The fitting of the coding plugs is reported by each 

£0 module, so that monitoring by the operating personnel is 

O provided at any time. 

f 

l© The invention furthermore relates to a control device for an 

ru 

installation that can endanger public safety, using a module 
described above, the module being connected to two manual 
control stations that are separate from one another. The 
manual control stations enable manual control of the module by 
20 the operating personnel while circumventing the control system 
for operating tasks. This is necessary in particular for a 
test of the installation. 

Furthermore, a method for controlling a drive using the above 
25 module in a control device of this type is described, in 

which, according to the invention, the state of the drive is 

-5- 



TER99P3467 

indicated in both manual control stations. Therefore, the 
operating personnel are always informed of the state of the 
drive . 

The software required for operating the module is 
advantageously read out by a diagnostic device. This enables 
the software present to be identified. 

By use of a separate measurement and test device, it is also 
possible to introduce new software with a low outlay. A 
software change is precluded as long as the module is 
installed in an installation. This precludes risks through 
software manipulations during operation. 

In a first advantageous development, the diagnostic device is 
connected to a bus connected to the module. The circuit is 
implemented in modern installations. The diagnostic device 
then tests the module via the bus and, if appropriate, further 
interposed systems . 

According to a second advantageous refinement, the diagnostic 
device is connected to the interface of the module. The 
circuit is used in older installations without a bus. 

The interface provided according to the invention allows 
connection both to a bus and to individual wires in older 



installations. The software of the module is coordinated with 
the control systems present in each case and the cabling. The 
module can therefore be integrated without any problems into 
the system present in the installation. Use is possible in 
5 any control system that can process individual signals or 
communicate via a bus. The interface is advantageously of 
redundant configuration, so that redundant systems of the 
control systems can be used. This allows the use of systems 
having high availability. 

if 

J! The module according to the invention enables a test of the 
T= priority function between operating tasks and safety tasks 

m 

during current operation by a "boundary scan test". The 

a 

y* testing of the control system for safety tasks with respect to 
l€I the module is effected by short, pulsed triggering of the 

o 

«U commands for the drive. At the same time, a test signal is 
communicated, which prevents a sharp start-up of the drive. 
The arrival of the commands is confirmed by the module. 
Therefore, a sharp start-up of the drive is only required for 
20 testing the control system for operating tasks. An 
operationally governed movement of the drive can be 
incorporated into the test . 



Other features which are considered as characteristic for the 
25 invention are set forth in the appended claims. 
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Although the invention is illustrated and described herein as 
embodied in a module for controlling a drive and a method of 
using the module, it is nevertheless not intended to be 
limited to the details shown, since various modifications and 
5 structural changes may be made therein without departing from 
the spirit of the invention and within the scope and range of 
equivalents of the claims. 

M The construction and method of operation of the invention, 
liy however, together with additional objects and advantages 

Si 

: ~ thereof will be best understood from the following description 

4= 
'~-J 

,rg of specific embodiments when read in connection with the 
:p accompanying drawings . 

f 

lfe Brief Description of the Drawings : 

ry 

Fig. 1 is a diagrammatic illustration of an installation 
according to the invention; 

Fig. 2 is a block diagram of a module according to the 
2 0 invention; 

Fig. 3 is a block diagram of a first circuit for using the 
module according to the invention; and 

25 Fig. 4 is a block diagram of a second circuit for using the 
module according to the invention. 
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Description of the Preferred Embodiments : 

Referring now to the figures of the drawing in detail and 
first, particularly, to Fig. 1 thereof, there is shown an 
5 installation 10 which can endanger public safety. The 

installation 10 has a series of drives 11 which are driven via 
modules 12. Each of the drives 11 is assigned exactly one 
module 12 . 

lit Fig. 2 diagrammatically illustrates the construction of the 
j= module 12. The module 12 contains a microprocessor 14, a 
CO logic circuit 15 and a timing circuit 16. The microprocessor 
O 14 is assigned a memory 17. Furthermore, terminals 18 and 
y outputs 19 are present, which can transmit a plurality of 
iff: signals, as illustrated by arrows 22 to 25. The 

microprocessor 14 and the logic circuit 15 are protected 
against a short circuit of the respective output 19 by an 
electronic protection device 21. The power required for 
operating the module 12 is supplied by a power supply 20. The 
20 module 12 furthermore has an interface 26 for connection to a 
diagnostic device or a bus. Coding plugs 27, which enable a 
movement of the drive 11, are provided on a side that is 
accessible in the installed state of the module 12 . 

25 Commands from a control system 31 for operating tasks and a 

control system 32 for safety tasks are fed to the module 12 in 
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accordance with the arrows 22, 23 (Figs. 3 and 4) . The 
commands of the control system 32 for safety tasks must be 
handled with priority. The logic circuit 15 has a fixed- 
programmed priority function for this purpose. 

5 

Depending on the commands received, the module 12 passes 
output signals to the drive 11 in accordance with the arrows 
24, 25. Start-up signals for the drive 11 or a test signal 
may be involved in this case. The state of the drive 11 is 
if? identified by the module 12, for example by an end stop switch 
Jfj or a measurement of the torque . 

s The commands and also the output signals are stored together 
SM= with the time of day in the memory 17, so that the operation 

liff is logged. For testing purposes, the memory 17 is read 

p 

[iy periodically or in a manner dependent on the operating 
behavior. 

The terminal 18 and the interface 26 also enable information 
20 to be retrieved from the module 12. In particular, the 
content of the memory 17 or the software used by the 
microprocessor 14 can be read out. Depending on the 
respective application, one or both terminals 18 may be 
omitted and their functions integrated into the interface 26. 
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Figs. 3 and 4 show two different connection variants. The 
variant in accordance with Fig. 3 shows the use of the module 
12 in a modern installation with a bus 30, while in Fig. 4 the 
module 12 has been retrofitted in an old installation with 
individual cabling. 

A main control center 2 8 and an emergency control center 2 9 
are provided in both variants. The installation is run by the 
main control center 2 8 in the normal state. After a failure 
of the main control center 28, a changeover is made to the 
emergency control center 29. The main control center 2 8 and 
the emergency control center 2 9 have control console panels 34 
for controlling specific operational -critical or safety- 
critical drives 11 manually. Furthermore, indicators 35 are 
provided which indicate the state of these or other drives 11. 

The control system 31 for operating tasks and the control 
system 32 for safety tasks are provided in both 
configurations. As soon as a safety-relevant state is 
identified, the required measures are proposed by the control 
system 32 for safety tasks or, depending on the setting, 
executed immediately. 

In Fig. 3, the module 12 is connected to the control system 31 
for operating tasks. The control system 31 is connected to 
the bus 30, which is connected to the main control center 2 8 
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and the emergency control center 29. A diagnostic device 33 
is clamped onto the bus 30. The control system 32 for safety 
tasks is independent of the bus 30. It is connected to the 
module 12, the main control center 2 8 and the emergency 
control center 29. 



In the configuration in accordance with Fig. 4, the module 12 
is not connected to the bus 30, but rather is cabled directly. 
The same reference symbols as in the previous figures are used 
for identical or functionally identical components. During 
normal operation, the module 12 is controlled by the main 
control center 2 8 via the control system 31 for operating 
tasks. If appropriate, the control system 32 for safety tasks 
intervenes, whose commands are handled with priority by the 
module 12. Both control systems 31, 32 are connected to the 
main control center 2 8 and the emergency control center 29. 



In both configurations, the space requirement and the power 
loss are significantly reduced by the module 12 according to 
the invention. Furthermore, the module 12 can be used in 
modern installations 10 with digital control technology, but 
can also be retrofitted in existing installations 10. 
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